How rewanthtammana/who-let-the-agents-act works
Who Let the Agents Act is a web-based educational lab for comparing vulnerable, prompt-only, and hardened AI-agent security designs. A user selects a scenario and mode, submits a prompt, and inspects the resulting plan, policy decisions, tool and database activity, and outcome. The nine labs cover distinct authorization, privacy, injection, retrieval, approval, and agent-handoff failures. The graph combines README-documented behavior with sampled files; API routing and most scenario internals were not sampled, so those connections are limited to documented workflow.
Main entry points: registry.py Scenario registry · langchain_agent.py Agent adapter · scenarios Scenario databases · app.py Web application
Components 17
Web experience
- Lab interface
static/app.js - Web application
app.py
Shared runtime
- Scenario registry
scenarios/registry.py - Agent adapter
core/langchain_agent.py
Security labs
- Excessive data access
scenarios/overpowered_data_tool - Cross-account access
scenarios/cross_customer_access - Unsafe agent handoff
scenarios/signed_handoff - Refund rule bypass
scenarios/business_rule - Invoice injection
scenarios/indirect_injection - Tenant RAG leakage
scenarios/rag_tenant_isolation - Debug secret leakage
scenarios - Approval outage
scenarios/approval_service_outage - Confused deputy
scenarios/multi_agent_confused_deputy
Scenario state
- Scenario databases
scenarios - Run trace
scenarios
Other components
- Lab user
- Groq model
Connections 32
- Lab user → Lab interface: submits prompt
- Lab interface → Web application: sends run
- Web application → Scenario registry: selects scenario
- Web application → Lab interface: returns result
- Scenario registry → Excessive data access: dispatches
- Scenario registry → Cross-account access: dispatches
- Scenario registry → Unsafe agent handoff: dispatches
- Scenario registry → Refund rule bypass: dispatches
- Scenario registry → Invoice injection: dispatches
- Scenario registry → Tenant RAG leakage: dispatches
- Scenario registry → Debug secret leakage: dispatches
- Scenario registry → Approval outage: dispatches
- Scenario registry → Confused deputy: dispatches
- Excessive data access → Agent adapter: requests model
- Cross-account access → Agent adapter: requests model
- Unsafe agent handoff → Agent adapter: requests model
- Refund rule bypass → Agent adapter: requests model
- Invoice injection → Agent adapter: requests model
- Tenant RAG leakage → Agent adapter: requests model
- Debug secret leakage → Agent adapter: requests model
- Approval outage → Agent adapter: requests model
- Confused deputy → Agent adapter: requests model
- Agent adapter → Groq model: invokes
- Excessive data access → Scenario databases: reads and writes
- Cross-account access → Scenario databases: reads and writes
- Unsafe agent handoff → Scenario databases: reads and writes
- Refund rule bypass → Scenario databases: reads and writes
- Invoice injection → Scenario databases: reads and writes
- Tenant RAG leakage → Scenario databases: reads and writes
- Approval outage → Scenario databases: reads and writes
- Confused deputy → Scenario databases: reads and writes
- Scenario databases → Run trace: records activity